CMMC Level 1 vs Level 2

The gap between the two levels is larger than the names suggest. Level 1 asks for 17 practices and an annual affirmation. Level 2 asks for 110 requirements, evidence against 320 assessment objectives, a System Security Plan, and a score the government relies on.

Which one applies is not a judgement call about how careful you are. It is decided by the category of information in your contracts.

Side by side

• Information: Level 1 covers FCI. Level 2 covers CUI.
• Source: Level 1 from FAR 52.204-21. Level 2 from NIST SP 800-171 Rev 2, via DFARS 252.204-7012.
• Count: 17 practices versus 110 requirements.
• Families: 6 versus 14.
• Assessment objectives: not applicable versus 320.
• Documentation: no SSP required versus 3.12.4 mandatory.
• Reporting: annual affirmation versus a score posted to SPRS under 7019 and 7020.
• Scoring: none versus the −203 to 110 scale.

The seven families that appear only at Level 2

Level 1 covers Access Control, Identification and Authentication, Media Protection, Physical Protection, System and Communications Protection, and System and Information Integrity — six families, lightly.

Level 2 adds seven more in full: Audit and Accountability, Configuration Management, Incident Response, Maintenance, Risk Assessment, Security Assessment and Personnel Security.

That is where the work is. Logging and alerting, configuration baselines, a tested incident response capability, vulnerability management, and a documented security assessment programme are the things a business rarely has by accident. See the fourteen families.

How to tell which applies to you

Read your contracts. FAR 52.204-21 indicates FCI and Level 1. DFARS 252.204-7012 indicates covered defense information, which means CUI and Level 2. If both appear across your portfolio, you are at Level 2 for anything touching the CUI.

The full clause-by-clause test is on does CMMC apply to my company, and the underlying distinction is covered on FCI vs CUI.

What the 17 practices actually ask for

FAR 52.204-21 is short enough to read in one sitting, and doing so is the fastest way to see how different the two regimes are in character. Its practices are basic hygiene stated plainly: limit system access to authorised users, limit the transactions those users can execute, control who may post to publicly accessible systems, sanitise media before disposal, escort visitors, use approved encryption on wireless, run antivirus and keep it current, apply patches.

Every one of those 17 has a counterpart inside the 110 — the Level 1 set is a proper subset, not a parallel standard. What the 110 add is not new subject matter so much as depth and proof. Level 1 asks you to limit access; Level 2 asks you to employ least privilege, separate duties, control privileged function execution, terminate sessions, and log all of it in a form somebody reviews. The difference is between doing a sensible thing and being able to demonstrate that you do it consistently.

Cost and effort, honestly compared

Level 1 is usually absorbed by an existing IT budget. Most of the 17 practices are satisfied by a competently administered Microsoft 365 or Google Workspace tenant with managed endpoints, and the annual affirmation is an internal exercise that consumes days rather than weeks. Firms with no security programme at all will have work to do, but it is ordinary work with ordinary tooling.

Level 2 is a different order of magnitude, and the reason is documentation and evidence rather than technology. The seven additional families require artefacts that do not exist unless somebody deliberately creates them: configuration baselines with a change process behind them, audit records with a documented review cadence, an incident response plan that has been exercised, a risk assessment on a stated schedule. A firm can hold every technical control on the list and still score poorly because none of it is written down in a form an assessor can test. See what CMMC actually costs for the line items.

A common and expensive mistake

Assuming Level 2 because it sounds safer. Building a Level 2 programme when you hold only FCI means paying for seven families of controls you do not owe, and it happens more often than the reverse — usually after a supplier questionnaire arrives and nobody stops to check which category is actually in play.

The opposite error is worse but rarer: treating a marked drawing as ordinary contract paperwork, staying at Level 1, and discovering the gap during an assessment or an incident.

Both are avoided the same way, by reading the clauses before deciding the programme.

What the 2026 suspension changed

Less than the headlines suggest, and nothing at all for Level 1.

Level 1 was always a self-assessment; it continues unchanged. Level 2 lost its third-party assessment layer when Phase 2 was suspended in July 2026 and the September class deviation directed contracting officers to remove those requirements from contracts. The 110 requirements, the self-assessment, the SPRS score and the liability for its accuracy all remain. See program status.

The full list of the 17 practices is on CMMC Level 1 requirements, and the 110 on CMMC Level 2 requirements.